Getting Data In

StatsD backend for Splunk

vistate
Explorer

With the release of Splunk 7 and Metrics being top priority - I am trying to configure StatsD to send UDP traffic to my Splunk indexer. However, I am unable to configure statsD properly.

Has anyone created a Splunk backend for StatsD? I cannot find any documentation on this yet and I can only find info on setting up graphite as a backend.

Please help.

0 Karma
1 Solution

mporath_splunk
Splunk Employee
Splunk Employee

Splunk acts as both server and backend in this instance. In 7.0, you would send metrics directly to Splunk, without summarizing with a statsd server first.

Alternatively, you can configure a custom sourcetype to parse the graphite plaintext protocol. This would allow you to use the same configuration having the statsd server send summarized metrics to Splunk. This is described in as an example for custom source types in http://docs.splunk.com/Documentation/Splunk/7.0.0/Metrics/GetMetricsInOther#Example_of_configuring_f...

View solution in original post

rjudet
New Member

Since 2017, it looks there should be an easier solution:

https://docs.splunk.com/Documentation/Splunk/7.2.0/Metrics/GetMetricsInStatsd

However, this is from Splunk Enterprise documentation, so my question would be: is this also available in Splunk Cloud, or, rather, how would we do it in Splunk Cloud?

Thanks

0 Karma

mporath_splunk
Splunk Employee
Splunk Employee

Splunk acts as both server and backend in this instance. In 7.0, you would send metrics directly to Splunk, without summarizing with a statsd server first.

Alternatively, you can configure a custom sourcetype to parse the graphite plaintext protocol. This would allow you to use the same configuration having the statsd server send summarized metrics to Splunk. This is described in as an example for custom source types in http://docs.splunk.com/Documentation/Splunk/7.0.0/Metrics/GetMetricsInOther#Example_of_configuring_f...

vistate
Explorer

This is what is not described on the original page located here.

However,

It looks like my solution will be using both distributed Collectd+statsd Plugin as well as some direct ingestion.

Thank you very much for explaining.

0 Karma

vistate
Explorer

I have managed to push to Splunk as a backend - however I am seeing this in the logs :

10-24-2017 12:17:01.099 -0400 ERROR MetricsProcessor - After splitting on delimiter (|), expected 2 tokens. Got 1 instead. Suppressing subsequent errors for source::tcp:8081, sourcetype::statsd, host::10.17.52.120 datastream...

0 Karma

gjanders
SplunkTrust
SplunkTrust
0 Karma

rjudet
New Member

However, this is from Splunk Enterprise documentation, so my question would be: is this also available in Splunk Cloud, or, rather, how would we do it in Splunk Cloud?

Thanks

0 Karma

vistate
Explorer

Hi @garethatiag - thank you - reviewed the document. But it does not answer my question 🙂

StatsD requires a backend configuration. And the backends available from statsD are Graphite,
console and some others(https://github.com/etsy/statsd/blob/master/docs/backend.md)

So what I'm looking for is a backend configuration for splunk.

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...